The selector controlled discovery but not every read path. A client already connected to the authorized MCP route could address a composite prompt name directly and receive material that the configuration had excluded from listings. Version 1.2.1 applies the selector at the direct access and completion interfaces. The caller must have a valid route…
Inspect the ClaimsCase · DiggingBeagle record
Agent Router prompt exclusions failed on direct MCP reads
Excluded prompts disappeared from listings yet remained retrievable by name.
Public disclosure: Nov 6, 2026
Scope
Agent Router MCP prompt filtering in version 1.2.0.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Repository advisory describes the prompts/list to prompts/get and completion/complete mismatch and a 1.2.1 fix. Exposure beyond an already connected route is not demonstrated. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AGENTROUTER-EXCLUDED-PROMPT-GET-01 · Agent Router MCP excluded prompt retrieval · Agent Router version 1.2.1 release
At a glance
Hiding an object from an index is not access control unless the same policy gates direct retrieval.
Read the implicationsThe caller must have a valid route connection and know the prompt name. Neither exposure of private production prompts nor an unrelated route escape is shown.
Limits and uncertaintyFull account
The selector controlled discovery but not every read path. A client already connected to the authorized MCP route could address a composite prompt name directly and receive material that the configuration had excluded from listings. Version 1.2.1 applies the selector at the direct access and completion interfaces.
The caller must have a valid route connection and know the prompt name. Neither exposure of private production prompts nor an unrelated route escape is shown.
The selector operated on discovery, not on every accessor. That matters because a consumer already holding a composite prompt name could bypass the filtered list without altering its authorized route. The advisory separates direct prompts/get and completion/complete, so a regression test must exercise both after the 1.2.1 upgrade. The effect is access to an excluded prompt through an existing connection, not a demonstrated escape into unrelated MCP routes.
Mechanism and trust boundary
- 01
List prompts with an exclusion selector.
- 02
Use a known name with prompts/get despite its absence from the list.
- 03
Retrieve excluded prompt content on the same route.
Claims & evidence
CLM-AGENTROUTER-EXCLUDED-PROMPT-GET-01Agent Router 1.2.0 promptSelector.exclude filtered prompts/list while permitting known excluded prompt names through prompts/get and completion/complete.supported
Basis: reported finding
- supportsAgent Router MCP excluded prompt retrievalprimary disclosure
Summary; promptSelector and direct prompts/get; 1.2.1 fix
Implications
Hiding an object from an index is not access control unless the same policy gates direct retrieval.
Controls and mitigations
- Upgrade to Agent Router 1.2.1 and test prompts/list, prompts/get and completion/complete with known excluded prompt names using the same route credentials.
- Treat selector exclusions as authorization policy for direct getters, not merely list display filters.
Unknowns and contradictions
- The caller must have a valid route connection and know the prompt name. Neither exposure of private production prompts nor an unrelated route escape is shown.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229